Elk Vulnerability Disclosure

generated: '2026-08-27'
method: probed
served: false
source: >-
  Live probes of https://elk.zone/vulnerability-disclosure,
  https://elk.zone/.well-known/security.txt, https://docs.elk.zone/.well-known/security.txt,
  https://raw.githubusercontent.com/elk-zone/elk/main/SECURITY.md,
  https://raw.githubusercontent.com/elk-zone/elk/main/.github/SECURITY.md and
  https://raw.githubusercontent.com/elk-zone/.github/main/SECURITY.md — all on 2026-08-27.
note: >-
  FALSE POSITIVE CORRECTED, 2026-08-27. Earlier rounds of this file (2026-07-11, and
  again when probe-security-programs.py re-ran today) recorded a "disclosure page" at
  https://elk.zone/vulnerability-disclosure on the strength of a 200 plus the keyword
  "vulnerability" in the body. There is no such page. elk.zone is a Nuxt SPA whose
  catch-all answers 200 with the same application shell for ANY unknown path; the only
  occurrence of "vulnerability" in that body is the requested route path echoed back in
  the Nuxt payload. Proof: /zzz-nonexistent-abc returns a byte-identical shell (22,661 vs
  22,666 bytes, differing only in the per-request CSP nonce). The keyword check matched
  its own URL.
  Elk publishes NO vulnerability disclosure policy: no security.txt on either host, and
  no SECURITY.md in the repository root, in .github/, or in the org .github repo. The
  `VulnerabilityDisclosure` pointer has been removed from apis.yml accordingly — a file
  documenting an absence must not be scored as a presence.
  A reporter's only route today is the public issue tracker,
  https://github.com/elk-zone/elk/issues, which is the wrong venue for an unpatched
  vulnerability. Adding a SECURITY.md would close this in one commit.
evidence:
  - url: https://elk.zone/vulnerability-disclosure
    status: 200
    verdict: soft-404
    detail: SPA catch-all shell, byte-identical to a nonsense path; no disclosure content.
  - url: https://elk.zone/zzz-nonexistent-abc
    status: 200
    verdict: soft-404
    detail: Control probe establishing the catch-all behaviour.
  - url: https://elk.zone/.well-known/security.txt
    status: 404
    verdict: absent
  - url: https://docs.elk.zone/.well-known/security.txt
    status: 404
    verdict: absent
  - url: https://raw.githubusercontent.com/elk-zone/elk/main/SECURITY.md
    status: 404
    verdict: absent
  - url: https://raw.githubusercontent.com/elk-zone/elk/main/.github/SECURITY.md
    status: 404
    verdict: absent
  - url: https://raw.githubusercontent.com/elk-zone/.github/main/SECURITY.md
    status: 404
    verdict: absent
bug_bounty:
  published: false
  programs_checked:
    - HackerOne
    - Bugcrowd
    - Intigriti
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com